Endpoint Protection

Hello - We need to turn off Webroot moentarily while we troubleshhot a computer's slowness - how can I do this?     thanks, Lisa

Can we alert or centrally audit on logon events?   As the console login is not tied to our AD (or AzureAD or federated) we have to manually audit logons to the console.   As anything manual becomes forgotten, can we alert on logons or pass the event to our logging system?   The same goes for policy changes.   Thanks, martin

How do we disable the shutdown agent command?   We want to install Webroot onto our Hyper-v, Exchange and AD servers but we don't want the AV admins to be able to shutdown (or reboot) these servers.   I can see that we can set up sub-administrators who don't have the permissions to issue commands but our global admin can bypass all of the security we have setup in AD to stop them accessing certain servers. And access to these commands (and logging in) does not seem to be alertable nor auditable (outside of the console).    Is there a way we can globally or selectivity disable/remove agent commands?   Is there a way to alert on logons?   Is there a way to alert on command actions?   Is there a way to export the logs?   Thanks, martin

This caused our customers who subscribe to your services or one of your partners (Cisco) to lose access to our site.  We reviewed our servers and found nothing to indicate we had a problem.   The canned  response (see below) provieded is not enough to justify the interupption to our business.  We want specific justification for your actions.   "Our automated evaluation system uses a machine learning algorithm to determine the reputation of an IP, to which the experience of a Web and Threat Analysis team is added when further research on a website is requested.  Unfortunately we cannot disclose the proprietary intelligence data collected regarding this site. If further details are needed you may elect to contact the IP owner in order to request more information about any recent changes to the site source code that may have triggered the scanners to flag the site as malicious. Best, Webroot BrightCloud Threat Intelligence Support

I was told the following by tech support today:   "Unfortunately the file (669.f70p53_i_b.dot) is NON-PE. This means the file is a file which does not contain a portable executable header i.e. .dot extension. Webroot is currently only capable of PE malware detection, however the program also contains a heuristics engine for some NON-PE files. In the future, this detection feature will be added." "Malware downloaders are commonly re-obfuscated and soon all antivirus will not detect examples of the document you have supplied. This is also true for malware in general." This was not verbatim but basically that non-PE files that are manually scanned (Right click, Scan with WebRoot) are not actually scanned or are scanned but WebRoot is mostly unable (depends on the exact file and type) to detect if the file is infected.  The proof is that the log file doesn't include an MD5 for the file."Re. #3, this means that even though the applicati

Agent Commands Download and Run is hit or miss. On some machines it will download the file, an exe and run it no issue. On other machines it just doesn't work.    1) where does the file get downloaded  so I can verify that part is working? 2) is there any log on the client to see what is going on? 3) any detailed information on this feature is greatly appericated.   Thanks, Brad

Hey All,   I have a client that has WSA installed on all their endpoints as well as their server.   There are roughly 10-20 simultaneous logged in users to the RDP server at any given time and we have gotten alerts that there was action taken against malware being executed on the server.   I have the alert setup to display the current user, but when they are logged into the RDP session, the alert comes through but doesn't show the logged in user in the alert email.   Is there a way to tell in the GSM or tweak the alert to show who is logged into the RDP server and triggered the malware alert?   Thanks John Nerds On Site

There are dozen different Webroot Application versions showing in my console.  How do I instruct the Console to update the user Webroot versions?  (Nothing to do with updating the Threat Signatures.)

Do I have the ability within my MSP WSA console, to assign the ability to make changes to the endpoint user interface?  In other words, I've allowed the endpoint GUI in a specific policy but when the end user opens the GUI, they cannot make any changes.  I get the attached message below.

I'm looking for a command line switch to see the version number of the currently installed version of Webroot SA without having to wait for a poll to the console.  I know that I can do WRSA.exe -poll and force an update, but it's very hard to see the version number when you have the system tray icon hidden from the end user.

My Company is considering switching to Webroot so we are testing it.   We have a problem in that Cisco Anyconnect VPN is not detecting Webroot so we can't VPN into network as it requires a valid updated and support Antivirus.   Any ideas would be appreciated..  

i am unable to reach /my.webrootanywhere.com/home.aspx. Is there a site outage? If so is there a place to check the sites status?

Hi, I have a Windows 2012 Essentals Server with a single Windows 10 PC connected . I also have a Windows 8 laptop and Windows 7 Media PC.   What I wanted to ask is that if I get the 5 device license would I be able to use/install it in my Laptop and PC which are NOT connected to the server or do I have to get seperate 'non-endpoint' licenses   Thanks Steve

Windows Backup failed while trying to read from the shadow copy on one of the volumes being backed up. Please check in the event logs for any relevant errors. (0x81000037). I get this error when I try to run a backup.  I have removed the quarentined files, at great hardship, and I am not sure that I removed them completely. I really could use some help on this.  

I just ran a scan and can no longer access Chrome- I get a sad face icon on the tab. Doesn't matter which site I try to access.

I've noticed a few detections of the following: CHROME-PATCH.EXE, W32.Adware.Gen, %cache%,   http://snup.webrootcloudav.com/SkyStoreFileUploader/upload.aspx?MD5=A8DBC384D9B82ED670193D042CDFD3F6 A8DBC384D9B82ED670193D042CDFD3F6,   Is this really bad, or is it just Chrome updating itself?

I have some machines that are in a Not Seen Recently status but when I check them the client is running.  Why does this happen and what are the security impacts?

Here is a screencast: https://i.gyazo.com/4396ba386f273c72b4639b930d8dd1ea.gif   Just wondering if there is a resource we can use to find out why this is happening. It is clear on all other validations that I know of other than this. The site is www.pureorganicvapors.com , Thanks!

I don't see where Webroot does any drive encryption but does anyone know of a product that is cheap and IS NOT active directory/policy driven?   I just have 2 laptops that my auditors are telling me i need to encrypt the drives and i'm looking for a cheap product that will allow me to do that.   Any suggestions?

Hi, We utilise webroot proxy for our business and roughly 15 pc's work through it. One person in the business spends their day searching the web for new retail clients we can supply too. However, when trying to access a good number of these websites they are blocked by webroot. This happens regularily and makes their job very difficult as to get each one unblocked requires a phone call to the IT support company we use, then a series of calls to get authorisation and a delay whilst webroot access updates. Our IT support company say that retail websites should be accessible but time and time again they are blocked. We have asked about reducing the security settings to enable more freedom and they said they cannot without loweringit for everybody else and endangering the whole office. This is making webroot really unpractical for us and wondered if you could provide a solution to present to them as they appear reluctant to offer us any o

Hey All,   I've tried and tried to ask the powers that be this question:   Why is there a 1000 count limit on the number of Sites that can be created under the GSM?   Our GSM has had the updates all pushed through with the 50 per page options and we've found that the response times of loading etc.. have all been good since those updates. I've not complained about GSM performance in ages now.   I'm looking for an actual technical explanation as to why there can't be more than 1000 Sites on a GSM. I know MSP's that have thousands and thousands of endpoints on a GSM, but why the limit of the number of sites I can create? This is the only way I can really account for my clients by separating them off into sites. Now I'm forced to juggle two GSMs in order to continue.   Does going over 1000 cause Webroot to implode or something? Cause after the updates, I don't buy the idea that it's not responsive etc... Y

Hi,   I would suggest business POLICY would have additional option to modify:   ALLOW EXCEPTIONS, which would allow end-user to add an exception (well, some end-users use cracked software and as I understand it is not my policy as a business WRSA reseller to tell them not to use such a software....so I as a Web Console caretaker would not like to add exceptions for end-users, because doing so I would break, for example, my agreement woth Microsoft as a Golden partner. But if end-user does it himself, it's not my concern)

Hello   I use policies to manage Secureanywhere Endpoints. If I allow the firewall with the police, I can't manage the firewall rules on the endpoints (for example in the order to allow a file block by webroot) .   So can I see what is blocked/allowed in an endpoint on the MSP console and can I allow/block an applications monitoring by the webroot firewallon  the console ? If not, what can I allow/block an application with Webroot FIrewall on the endpoint ?   Best regards Alexia

I am using SecureAnywhere.  I have created a policy specifically for admins.  The purpose of the policy is to allow admins to turn off any part of Webroot running on their PC.  Under Basic Configuration, I have set "Allow SecureAnywhere to be shut down manually" but I see no effect from that and still no way to stop SecureAnywhere.

We are website designers and one of our latest websites is being listed as "Reputation: SUSPICIOUS"    How can we go about getting this website reviewed and reslistd as safe ??